From 3365dc64e8336b15498ebe004a7bd61e58b668fd Mon Sep 17 00:00:00 2001
From: Michael Biebl <biebl@debian.org>
Date: Sat, 24 Oct 2020 20:44:48 +0200
Subject: [PATCH] Import Debian changes 241-7~deb10u5
systemd (241-7~deb10u5) buster; urgency=medium
* basic/cap-list: parse/print numerical capabilities (Closes: #964926)
* missing: add new Linux capabilities.
Linux kernel v5.8 adds two new capabilities. Make sure we can recognize
them even when built with an older kernel.
* networkd: do not generate MAC for bridge device (Closes: #963488)
---
debian/changelog | 10 +++
...t-parse-print-numerical-capabilities.patch | 87 +++++++++++++++++++
.../missing-Add-new-Linux-capabilities.patch | 36 ++++++++
...o-not-generate-MAC-for-bridge-device.patch | 24 +++++
debian/patches/series | 3 +
5 files changed, 160 insertions(+)
create mode 100644 debian/patches/basic-cap-list-parse-print-numerical-capabilities.patch
create mode 100644 debian/patches/missing-Add-new-Linux-capabilities.patch
create mode 100644 debian/patches/networkd-do-not-generate-MAC-for-bridge-device.patch
diff --git a/debian/changelog b/debian/changelog
index 14ef57fb..8c3b2769 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+systemd (241-7~deb10u5) buster; urgency=medium
+
+ * basic/cap-list: parse/print numerical capabilities (Closes: #964926)
+ * missing: add new Linux capabilities.
+ Linux kernel v5.8 adds two new capabilities. Make sure we can recognize
+ them even when built with an older kernel.
+ * networkd: do not generate MAC for bridge device (Closes: #963488)
+
+ -- Michael Biebl <biebl@debian.org> Sat, 24 Oct 2020 20:44:48 +0200
+
systemd (241-7~deb10u4) buster; urgency=medium
* polkit: when authorizing via PolicyKit re-resolve callback/userdata
diff --git a/debian/patches/basic-cap-list-parse-print-numerical-capabilities.patch b/debian/patches/basic-cap-list-parse-print-numerical-capabilities.patch
new file mode 100644
index 00000000..3b9eb09a
--- /dev/null
+++ b/debian/patches/basic-cap-list-parse-print-numerical-capabilities.patch
@@ -0,0 +1,87 @@
+From: =?utf-8?q?Zbigniew_J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Thu, 9 Jul 2020 23:15:47 +0200
+Subject: basic/cap-list: parse/print numerical capabilities
+
+We would refuse to print capabilities which were didn't have a name
+for. The kernel adds new capabilities from time to time, most recently
+cap_bpf. 'systmectl show -p CapabilityBoundingSet ...' would fail with
+"Failed to parse bus message: Invalid argument" because
+capability_set_to_string_alloc() would fail with -EINVAL. So let's
+print such capabilities in hexadecimal:
+
+CapabilityBoundingSet=cap_chown cap_dac_override cap_dac_read_search
+ cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap
+ cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin
+ cap_net_raw cap_ipc_lock cap_ipc_owner 0x10 0x11 0x12 0x13 0x14 0x15 0x16
+ 0x17 0x18 0x19 0x1a ...
+
+For symmetry, also allow capabilities that we don't know to be specified.
+
+Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1853736.
+
+(cherry picked from commit 417770f3033c426ca848b158d0bf057cd8ad1329)
+---
+ src/basic/cap-list.c | 10 +++++++---
+ src/test/test-cap-list.c | 4 +++-
+ 2 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/src/basic/cap-list.c b/src/basic/cap-list.c
+index 29a17d9..b72b037 100644
+--- a/src/basic/cap-list.c
++++ b/src/basic/cap-list.c
+@@ -10,6 +10,7 @@
+ #include "macro.h"
+ #include "missing.h"
+ #include "parse-util.h"
++#include "stdio-util.h"
+ #include "util.h"
+
+ static const struct capability_name* lookup_capability(register const char *str, register GPERF_LEN_TYPE len);
+@@ -37,7 +38,7 @@ int capability_from_name(const char *name) {
+ /* Try to parse numeric capability */
+ r = safe_atoi(name, &i);
+ if (r >= 0) {
+- if (i >= 0 && (size_t) i < ELEMENTSOF(capability_names))
++ if (i >= 0 && i < 64)
+ return i;
+ else
+ return -EINVAL;
+@@ -65,11 +66,14 @@ int capability_set_to_string_alloc(uint64_t set, char **s) {
+ for (i = 0; i < cap_last_cap(); i++)
+ if (set & (UINT64_C(1) << i)) {
+ const char *p;
++ char buf[2 + 16 + 1];
+ size_t add;
+
+ p = capability_to_name(i);
+- if (!p)
+- return -EINVAL;
++ if (!p) {
++ xsprintf(buf, "0x%lx", i);
++ p = buf;
++ }
+
+ add = strlen(p);
+
+diff --git a/src/test/test-cap-list.c b/src/test/test-cap-list.c
+index de5fa72..84bbb7b 100644
+--- a/src/test/test-cap-list.c
++++ b/src/test/test-cap-list.c
+@@ -30,6 +30,8 @@ static void test_cap_list(void) {
+ assert_se(capability_from_name("cAp_aUdIt_rEAd") == CAP_AUDIT_READ);
+ assert_se(capability_from_name("0") == 0);
+ assert_se(capability_from_name("15") == 15);
++ assert_se(capability_from_name("63") == 63);
++ assert_se(capability_from_name("64") == -EINVAL);
+ assert_se(capability_from_name("-1") == -EINVAL);
+
+ for (i = 0; i < capability_list_length(); i++) {
+@@ -64,7 +66,7 @@ static void test_capability_set_one(uint64_t c, const char *t) {
+
+ free(t1);
+ assert_se(t1 = strjoin("'cap_chown cap_dac_override' \"cap_setgid cap_setuid\"", t,
+- " hogehoge foobar 12345 3.14 -3 ", t));
++ " hogehoge foobar 18446744073709551616 3.14 -3 ", t));
+ assert_se(capability_set_from_string(t1, &c1) == 0);
+ assert_se(c1 == c_masked);
+ }
diff --git a/debian/patches/missing-Add-new-Linux-capabilities.patch b/debian/patches/missing-Add-new-Linux-capabilities.patch
new file mode 100644
index 00000000..324e0247
--- /dev/null
+++ b/debian/patches/missing-Add-new-Linux-capabilities.patch
@@ -0,0 +1,36 @@
+From: =?utf-8?q?Michal_Koutn=C3=BD?= <mkoutny@suse.com>
+Date: Wed, 24 Jun 2020 12:43:22 +0200
+Subject: missing: Add new Linux capabilities
+
+Linux kernel v5.8 adds two new capabilities. Make sure we can recognize
+them even when built with an older kernel.
+
+(cherry picked from commit e41de5e491942b5391b1efb71c82ffd329b3d23d)
+---
+ src/basic/missing_capability.h | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/src/basic/missing_capability.h b/src/basic/missing_capability.h
+index 1308a3d..dd6bccd 100644
+--- a/src/basic/missing_capability.h
++++ b/src/basic/missing_capability.h
+@@ -10,3 +10,19 @@
+ #undef CAP_LAST_CAP
+ #define CAP_LAST_CAP CAP_AUDIT_READ
+ #endif
++
++/* 980737282232b752bb14dab96d77665c15889c36 (5.8) */
++#ifndef CAP_PERFMON
++#define CAP_PERFMON 38
++
++#undef CAP_LAST_CAP
++#define CAP_LAST_CAP CAP_PERFMON
++#endif
++
++/* a17b53c4a4b55ec322c132b6670743612229ee9c (5.8) */
++#ifndef CAP_BPF
++#define CAP_BPF 39
++
++#undef CAP_LAST_CAP
++#define CAP_LAST_CAP CAP_BPF
++#endif
diff --git a/debian/patches/networkd-do-not-generate-MAC-for-bridge-device.patch b/debian/patches/networkd-do-not-generate-MAC-for-bridge-device.patch
new file mode 100644
index 00000000..b8788fbd
--- /dev/null
+++ b/debian/patches/networkd-do-not-generate-MAC-for-bridge-device.patch
@@ -0,0 +1,24 @@
+From: Susant Sahani <ssahani@gmail.com>
+Date: Tue, 14 May 2019 11:45:23 +0200
+Subject: networkd: do not generate MAC for bridge device.
+
+closes https://github.com/systemd/systemd/issues/12558
+
+(cherry picked from commit deb2cfa4c6885d448eb1f17e5ef1b139106b7e86)
+---
+ src/network/netdev/netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/network/netdev/netdev.c b/src/network/netdev/netdev.c
+index ecd6cf4..6ef1631 100644
+--- a/src/network/netdev/netdev.c
++++ b/src/network/netdev/netdev.c
+@@ -720,7 +720,7 @@ int netdev_load_one(Manager *manager, const char *filename) {
+ if (!netdev->filename)
+ return log_oom();
+
+- if (!netdev->mac && netdev->kind != NETDEV_KIND_VLAN) {
++ if (!netdev->mac && !IN_SET(netdev->kind, NETDEV_KIND_VLAN, NETDEV_KIND_BRIDGE)) {
+ r = netdev_get_mac(netdev->ifname, &netdev->mac);
+ if (r < 0)
+ return log_error_errno(r, "Failed to generate predictable MAC address for %s: %m", netdev->ifname);
diff --git a/debian/patches/series b/debian/patches/series
index 478c6427..c608be74 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -52,6 +52,9 @@ polkit-use-structured-initialization.patch
sd-bus-introduce-API-for-re-enqueuing-incoming-messages.patch
polkit-when-authorizing-via-PK-let-s-re-resolve-callback-.patch
Fix-typo-in-function-name.patch
+basic-cap-list-parse-print-numerical-capabilities.patch
+missing-Add-new-Linux-capabilities.patch
+networkd-do-not-generate-MAC-for-bridge-device.patch
debian/Use-Debian-specific-config-files.patch
debian/Bring-tmpfiles.d-tmp.conf-in-line-with-Debian-defaul.patch
debian/Make-run-lock-tmpfs-an-API-fs.patch
--
GitLab